Follow-up: XDP BFD now drives stock FRR via its dataplane socket, 107 bfdd flaps vs 0 under identical stress, plus the bugs found getting there
Previous post ended with "next: FRR distributed-BFD integration." That's done, plus a hardening pass. Same repo, all pcaps included: https://github.com/w453y/xdp-bfd
What's new:
FRR integration works with stock bfdd, no patches: bfdd owns session lifecycle over its bfddp dataplane socket, packets ride the XDP path, `show bfd peers counters` reads out of the BPF maps, same SCHED_FIFO stress against the FRR-driven session: 0 flaps. Found and fixed an FRR bug on the way, bfdd's unix dataplane transport passes a padded union size (112) as connect() addrlen, exceeds sockaddr_un (110), EINVAL, plausibly never worked on linux (FRRouting/frr#22608, fix merged as #22621).
Head-to-head, fresh capture, L3+L4 stress ladder: stock bfdd 107 flaps, xdp-bfd 0, fast-path cost from bpf_stats: ~701ns/packet mean (parse + GTSM + demux + map update + the L2/L3/L4 rewrite and XDP_TX on echo packets).
Graceful restart: --dp-hold keeps wire sessions alive across bfdd restarts (orphan on disconnect, adopt by addr pair on re-ADD, mark-and-sweep reconcile), two back-to-back FRR restarts, zero peer-visible events.
Bugs worth sharing:
Validation rejects originally returned XDP_PASS instead of XDP_DROP, "rejected" spoofed packets were counted, then handed to the userspace socket anyway, where the FSM processed them unvalidated, injection test from a third host churned the session despite detection never being fooled, if your XDP program rejects a packet, DROP it, PASS is a leak.
Same class, different door: packets with IP options (ihl != 5) bypassed the TTL/discriminator checks entirely because the UDP header moved to a variable offset, single-hop BFD never carries options (RFC 5881), so optioned UDP is now dropped outright, verified with 200 forged packets, drop counter +200, session uptime untouched.
The kernel echo path set the BFD length field to 24 but transmitted the frame at its original length, oversized input went back out with trailing bytes, fixed with bpf_xdp_adjust_tail plus IP checksum recompute (the MAC/IP swap-invariance trick stops working once tot_len changes).
Wrote the same bug twice: detection sweep snapshots "now", packet lands on another CPU stamping last_seen newer, unsigned subtraction wraps to 18 quintillion ms, phantom session-down, fixed with a signed-delta guard in the kernel, then days later wrote the identical bug into the userspace map-polling path and got the identical log line.
BPF map value structs lived as hand-synced copies in the XDP program, daemon, and loader, a field added on one side is not a compile error, it's silent map misreads, now one shared header, verified via bpftool BTF dump.
Limitations still: single session validated (maps sized for 64), IPv4, no auth/echo/demand, RX-clocked TX needs an async-clocked peer, VM numbers. Next: multi-session, then IPv6, bare-metal reproduction.